Skip to content
Threat Feed
Subscribe
high advisory

Network-AI: Path traversal in InputSanitizer (CVE-2026-120313)

Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.

CVE search metadata

CVE search record: CVE-2026-120313. Severity: high. CVSS: 7.5. KEV: no. Product: Network-AI (< 5.15.5), Network-AI (5.14.0 <= version < 5.15.5). Brief: Network-AI: Path traversal in InputSanitizer (CVE-2026-120313). Brief link: https://feed.craftedsignal.io/briefs/2026-11-network-ai-path-traversal-9c1f04f0/

CVE search record: CVE-2026-120314. Severity: high. CVSS: 7.3. KEV: no. Product: Network-AI (< 5.15.5), Network-AI (5.14.0 <= version < 5.15.5). Brief: Network-AI: Path traversal in InputSanitizer (CVE-2026-120313). Brief link: https://feed.craftedsignal.io/briefs/2026-11-network-ai-path-traversal-9c1f04f0/

Triage facts

Revision 1
Applicability
Network-AI (< 5.15.5), Network-AI (5.14.0 <= version < 5.15.5)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 2, 05:17 UTC
Detection
1 rule
Vulnerabilities
2 CVEs
Source quality
A1Likely

What's new

  • 1. added detection rule: Detects CVE-2026-120314 Exploitation - Unauthorized Task Management Requests Nov 2, 05:17 via nvd

Network-AI versions prior to 5.15.5 are susceptible to a path traversal vulnerability located in the InputSanitizer.sanitizePath() function. The vulnerability arises from an unanchored "startsWith" check used during input validation. By providing a sibling-directory path that shares a string prefix with the intended base directory, an attacker can bypass these checks to access, list, or write files outside of the configured sandbox.

Impact

Unauthorized access allows attackers to read, list, or write files on the host filesystem that are outside of the restricted sandbox directory.

Recommendation

  • Upgrade Network-AI to version 5.15.5 or later.
  • Implement strict input validation or use established path-canonicalization libraries that do not rely on unanchored prefix comparisons for path isolation.
  • Audit file system access logs for operations targeting directories outside of the designated application storage path.

Immediate actions

Inventory all instances of Network-AI in the environment and determine if secret configuration is active.

IT Operations 24h

Threat Hunt

Hunt for file access attempts containing directory traversal sequences (e.g., ../) or sibling-directory prefixes targeting paths outside the application sandbox.

T1083 medium medium confidence hunt now

Data: Application audit logs, Filesystem access telemetry

Search web logs for POST requests to /tasks/ endpoints originating from untrusted or external IP addresses.

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Upgrade Network-AI to 5.15.5 or later

immediate IT Operations

CVE-2026-120313

Upgrade Network-AI to 5.15.5 or later.

immediate IT Operations

CVE-2026-120314

Detection coverage 1

Detects CVE-2026-120314 Exploitation - Unauthorized Task Management Requests

high

Detects potential exploitation of CVE-2026-120314 where JSON-RPC requests are made to task management endpoints without expected authorization headers.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →